3.15.8 Isolating a Workspace to Prevent Browser Attacks

Instance administrators can configure limits to isolate a workspace and prevent browser attacks.

3.15.8.1 About Isolating a Workspace to Prevent Browser Attacks

Isolating workspaces is an effective approach to preventing browser attacks.

The only way to truly isolate a workspace is to enforce different domains in the URL by configuring the Allow Hostnames attribute. When the URLs of the attacker and the victim have different domains and hostnames, the browser's same-origin policy prevents attacks.

3.15.8.2 Configuring Workspace Isolation Attributes

Configure Workspace Isolation attributes.

To configure Workspace Isolation attributes:

  1. View the existing workspace:
    1. Sign in to Oracle Application Express Administration Services.
    2. Click Manage Workspaces.
    3. Under Workspace Reports, click Existing Workspaces.
    4. Click a workspace name.
    The Edit Information page appears.
  2. Locate Workspace Isolation and edit the attributes as described in the following table.

    Tip:

    To learn more about an attribute and view examples, see field-level Help.

    Table 3-5 Workspace Isolation Attributes

    Attribute Description

    Allow Hostnames

    Enter a comma separated list of hostnames that can be used to access this workspace. If you leave this attribute empty, the instance-level value applies. If you enter one or more hostnames, the incoming HTTP request URL's hostname part must match one of the listed hostnames.

    To learn more, see field-level Help.

    Resource Consumer Group

    Specify the Database Resource Manager consumer group to be used for all page events associated with this workspace. If you leave this attribute empty, the instance-level value applies. At the beginning of every request, the Application Express engine switches the current consumer group of the current database session to the workspace's consumer group. This applies to both executing applications and any of the applications used within the Application Express development environment.

    The privilege to switch to this consumer group must be granted to either PUBLIC or the Application Express schema. This privilege is typically granted using the procedure DBMS_RESOURCE_MANAGER_PRIVS.GRANT_SWITCH_CONSUMER_GROUP.

    Maximum Concurrent Workspace Requests

    Enter the maximum number of concurrent page events that Oracle Application Express supports for all applications of this workspace. If you leave this attribute empty, the instance-level value applies. Instead of processing a page event, Application Express shows an error message when the limit is already reached.

    Application Express keeps track of session requests by querying the CLIENT_INFO column of GV$SESSION. This tracking will not work if developers overwrite CLIENT_INFO, e.g. with a call to DBMS_APPLICATION_INFO.SET_CLIENT_INFO.

    Maximum Concurrent Session Requests

    Enter the maximum number of concurrent page events that Oracle Application Express supports for each session of this workspace's applications. Instead of processing a new page event, Application Express shows an error message when the limit is already reached. Alternatively, use the Concurrent Session Requests Kill Timeout attribute to kill an active database session, to process the new page event.

    Application Express keeps track of session requests by querying the CLIENT_IDENTIFIER column of GV$SESSION. This tracking will not work if developers overwrite CLIENT_IDENTIFIER, for example with a call to DBMS_SESSION.SET_IDENTIFIER.

    Concurrent Session Requests Kill Timeout

    If a new page event comes in that is outside the limits of Maximum Concurrent Session Requests, Application Express can execute alter system kill session on the oldest active database session which processes another page event for this Application Express session. This attribute specifies the number of seconds a database process has to be active, before it can be killed. If you leave this attribute empty, the instance-level value applies.

    Warning: Killing sessions can cause problems with the application server's database session pool.

    Maximum Size of Files in Workspace

    Enter the total size (in bytes) of all files that can be uploaded to this workspace.

    Maximum Email Messages

    Enter the maximum number of email messages that can be sent with the APEX_MAIL API per 24 hour period.

    This value overrides the instance-level setting.

    Maximum Web Service Requests

    Enter the maximum number of web service requests that can be sent per 24 hour period.

    Content Cache target size

    Denotes the target size for the content cache on workspace level.

    This value overrides the instance-level setting.

    Content Cache maximum entry size

    Denotes the maximum size for content to be placed into the content cache.

    This value overrides the instance-level setting.

  3. Click Apply Changes.